Organisations now have a clearer route for replacing cryptography that could be vulnerable to future quantum computers. The US National Institute of Standards and Technology has published final guidance setting out how agencies and businesses can plan that transition without treating it as a single software update.
The report, NISTIR 8547, follows the agency’s first post-quantum cryptography standards. It focuses on inventory, prioritisation and staged replacement: organisations need to know where vulnerable algorithms are used, which systems protect long-lived information and which suppliers control the underlying technology.
Why does post-quantum migration need to start now?
A cryptographically relevant quantum computer does not yet exist. The risk is that encrypted information collected today could be stored and decrypted later. Data that must remain confidential for many years therefore deserves earlier attention than short-lived information.
NIST says there is no single timetable that fits every organisation. A hospital, bank, cloud provider and small manufacturer will have different systems and risk profiles. The practical first step is a cryptographic inventory covering applications, devices, certificates, protocols and third-party services.
What should technology teams prioritise?
The roadmap points organisations towards approved post-quantum standards, including FIPS 203 for key establishment. Priority should go to systems holding long-lived sensitive data, externally exposed services and products with slow replacement cycles. Procurement also matters: contracts written now can require suppliers to explain how products will support new algorithms.
Migration is likely to involve testing, interoperability work and hybrid periods in which conventional and post-quantum methods operate together. Teams should also avoid assuming that adding a new algorithm solves unrelated weaknesses in identity, key management or software maintenance.
What changes for boards and buyers?
Post-quantum preparation is becoming a governance and supply-chain question, not only a specialist cryptography project. Leaders can ask whether the organisation knows where encryption is used, who owns the transition plan and whether new purchases can be upgraded. The roadmap gives those conversations a common reference point while leaving detailed schedules to each organisation’s circumstances.
Reporting basis: NIST’s 27 October 2026 announcement and the NISTIR 8547 publication page.
Image: FlyD via Unsplash.